Docker Image Vulnerability Research

Re:Docker Image Vulnerability Research by philips on Tuesday March 14, 2017 @04:18PM (#13871107)

This is something near and dear to my heart! The great thing about container images is the software distribution is based on static assets. This enables scanners to give teams actionable data without being on every host. This is a net new capability and I think enables better security in organizations who adopt containers. And unlike "VM sprawl" container systems are generally introspectable via a cluster level API like Kubernetes and scanning doesn't require active agents on every node. Two things that have happened recently in this space:

- Quay.io[1] offers scanning as a standard feature on all accounts including free open source accounts. This also includes notifications to external services like Slack. This is what it looks like when you ignore an image[1].

- The Kubernetes community has started automating scans of all of the containers that are maintained by that community to ensure that they are patched and bumped to the latest versions. A recent example[2].

The cool thing is that both of these systems utilize Clair[3] Open Source Project as a way of gathering up data sources from all of the various distribution projects. This all leads to the reason we feel automated updates of distributed systems are so critical and why CoreOS continues to push forward these concepts in CoreOS Tectonic[4].

[0] https://blog.quay.io/quay-secscanner-clair1/

[1] https://quay.io/repository/philips/host-info?tag=latest&tab=...

[2] https://github.com/kubernetes/kubernetes/pull/42933

[3] https://github.com/coreos/clair

[4] https://coreos.com/tectonic

[ Parent | on HN ]

Re:Docker Image Vulnerability Research by jsulinski on Tuesday March 14, 2017 @04:28PM (#13871179)

Absolutely. Huge props to CoreOS and the Kube community for pushing forward with this stuff.

I gave Clair a shout out in the article, and I intend on adding it as an optional scanner to Federacy.

Funny, I'm pretty sure we met before either of us started our existing ventures, when you came to the San Francisco DevOps meetups. :)

[ Parent | on HN ]

Re:Docker Image Vulnerability Research by philips on Tuesday March 14, 2017 @04:57PM (#13871393)

Sounds great!

If you hit any issues with Clair feel free to file an issue; we have a lot of folks who have been helping maintain the project.

Some quick feedback from the post and your website. It says there is a quick command to scan my container images but I couldn't find the command. I also signed up but the confirmation URL was a 404 and from "team" with subject "Confirmation email".

In any case really happy to see more people digging into these problems and coming up with new solutions.

[ Parent | on HN ]

Re:Docker Image Vulnerability Research by jsulinski on Tuesday March 14, 2017 @05:22PM (#13871599)

Thanks sir! I redesigned my landing page and made it static; forgot to update the confirmation email link.

The command is a standard 'wget/bash' script that you will receive when you login, but it's pretty simple to grok.

I'll send you a new confirmation email soon.

[ Parent | on HN ]

Re:Docker Image Vulnerability Research by jsulinski on Tuesday March 14, 2017 @05:38PM (#13871694)

Fixed!

[ Parent | on HN ]

Re:Docker Image Vulnerability Research by philips on Tuesday March 14, 2017 @05:58PM (#13871856)

Got it!

[ Parent | on HN ]